{"id":2808,"date":"2021-02-19T17:19:50","date_gmt":"2021-02-19T16:19:50","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=2808"},"modified":"2023-12-24T12:37:18","modified_gmt":"2023-12-24T11:37:18","slug":"the-linux-executable-and-linking-format-elf","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=2808","title":{"rendered":"The Linux Executable and Linking Format (ELF<\/span>)"},"content":{"rendered":"\n

Concepts<\/h2>\n\n\n\n

A seg\u00adment<\/strong> is a piece of a infor\u00adma\u00adtion which is mapped into the mem\u00ado\u00adry (of a process). A ELF<\/span> bina\u00adry can have zero or mul\u00adti\u00adple seg\u00adments. It defines also where the OS<\/span> should put it into the mem\u00ado\u00adry. Each seg\u00adment has a Pro\u00adgram Head\u00ader which describes the sec\u00adtions<\/em> within.<\/p>\n\n\n\n

A sec\u00adtion<\/strong> is a dis\u00adtinc\u00adtive part of a seg\u00adment with a defined pur\u00adpose. A seg\u00adment can have zero or mul\u00adti\u00adple sections.<\/p>\n\n\n\n

The ELF<\/span> header<\/h2>\n\n\n\n

The ELF<\/span> file head\u00ader looks like this:<\/p>\n\n\n\n

# hexdump \/bin\/ls -C | head\n00000000  7f 45 4c 46 02 01 01 00  00 00 00 00 00 00 00 00\n00000010  03 00 3e 00 01 00 00 00  60 61 00 00 00 00 00 00\n00000020  40 00 00 00 00 00 00 00  68 37 02 00 00 00 00 00\n00000030  00 00 00 00 40 00 38 00  0b 00 40 00 1e 00 1d 00<\/pre>\n\n\n\n
Expla\u00adna\u00adtion:<\/p>\n\n\n\n
Byte#<\/th>Byte<\/th>Con\u00adtent<\/th><\/tr><\/thead>
1<\/td>7F<\/span><\/td><\/td><\/tr>
2<\/td>45<\/td>E<\/td><\/tr>
3<\/td>4C<\/span><\/td>L<\/td><\/tr>
4<\/td>46<\/td>F<\/td><\/tr>
5<\/td>02<\/td>Class:
0 = None
1 = 32 Bit object
2 = 64 Bit object<\/td><\/tr>
6<\/td>01<\/td>Data encod\u00ading:
0 = None
1 = LSB<\/span>
2 = MSB<\/span><\/td><\/tr>
7<\/td>01<\/td>Ver\u00adsion. There is only ver\u00adsion 1.<\/td><\/tr>
8<\/td>00<\/td>ABI<\/span> Appli\u00adca\u00adtion Bina\u00adry Inter\u00adface:
0 = None\/System V (most\u00adly used)
1 = HP-UX<\/span>
2 = NetB\u00adSD
3 = Linux<\/td><\/tr>
9<\/td>00<\/td>ABI<\/span> ver\u00adsion. Nor\u00admal\u00adly 0.<\/td><\/tr>
10<\/td>00<\/td>Padding<\/em><\/td><\/tr>
11<\/td>00<\/td>Padding<\/em><\/td><\/tr>
12<\/td>00<\/td>Padding<\/em><\/td><\/tr>
13<\/td>00<\/td>Padding<\/em><\/td><\/tr>
14<\/td>00<\/td>Padding<\/em><\/td><\/tr>
15<\/td>00<\/td>Padding<\/em><\/td><\/tr>
16<\/td>00<\/td>Padding<\/em><\/td><\/tr>
17 18<\/td>03 00<\/td>File Type:
0 ET_NONE<\/span> = None
1 ET_REL<\/span> = Relo\u00adcat\u00adable file (.o)
2 ET_EXEC<\/span> = Exe\u00adcutable file
3 ET_DYN<\/span> = Shared object file (.so)
4 ET_CORE<\/span> = Core file (mem\u00ado\u00adry dump file)<\/td><\/tr>
19 20<\/td>3e 00<\/td>Machine Type:
0x03 = x86
0x28 = ARM<\/span>
0x3E = amd64 <\/td><\/tr>
21 22 23 24<\/td>01 00 00 00<\/td>Ver\u00adsion. Always 1.<\/td><\/tr>
25 26 27 28 29 30 31 32<\/td>60 61 00 00 00 00 00 00<\/td>Rel\u00ada\u00adtive address of the main func\u00adtion: 0x6160<\/code> (or 0 for libraries)<\/td><\/tr>
33 34 35 36 37 38 39 40<\/td>40 00 00 00 00 00 00 00<\/td>Start of the pro\u00adgram head\u00aders (from byte 64 on rel\u00ada\u00adtive to the begin\u00adning of the file.)<\/td><\/tr>
41 42 43 44 45 46 47 48<\/td>68 37 02 00 00 00 00 00<\/td>Start of the sec\u00adtion head\u00aders (from byte  0x023768 = 145256<\/code> on rel\u00ada\u00adtive to the begin\u00adning of the file.)<\/td><\/tr>
49 50 51 52<\/td>00 00 00 00<\/td>Proces\u00adsor flags<\/td><\/tr>
53 54<\/td>40 00<\/td>Size of this head\u00ader head\u00ader (until byte 64; kind of use\u00adless here)<\/td><\/tr>
55 56<\/td>38 00<\/td>Size of the pro\u00adgram head\u00aders: 0x38 = 56<\/code> byte.<\/td><\/tr>
57 58<\/td>0b 00<\/td>Num\u00adber of pro\u00adgram head\u00aders: 11<\/code><\/td><\/tr>
59 60<\/td>40 00<\/td>Size of sec\u00adtion head\u00aders: 0x40 = 64 <\/code>byte.<\/td><\/tr>
61 62<\/td>1e 00<\/td>Num\u00adber of sec\u00adtion head\u00aders: 30<\/code><\/td><\/tr>
63 64<\/td>1d 00<\/td>Index of sec\u00adtion head\u00ader string table: 29<\/code><\/td><\/tr><\/tbody><\/table>
ELF<\/span> head\u00ader explained<\/figcaption><\/figure>\n\n\n\n
This infor\u00adma\u00adtion can also be obtained with readelf -h \/bin\/ls<\/code>.<\/p>\n\n\n\n
ELF<\/span> symbols<\/h2>\n\n\n\n
A sym\u00adbol<\/em> is a ref\u00ader\u00adence to code or data like a vari\u00adable or func\u00adtion. There are usu\u00adal\u00adly two sec\u00adtions with sym\u00adbol tables:<\/p>\n\n\n\n